Nelio Ab Testing CVE-2026-32573

Requires high-privilege authenticated access (administrator role) to Nelio AB Testing WordPress plugin version 8.2.7 or earlier. Attacker with admin credentials can inject and execute arbitrary code remotely without user interaction.

This vulnerability represents critical real-world risk despite missing CVSS and EPSS scores. The risk signals are unanimously severe: the attack vector is network-based (WordPress plugins are typically internet-accessible), the CWE-94 classification indicates code injection leading to arbitrary execution, and the tags explicitly identify RCE capability. The presence of an ENISA EUVD ID (EUVD-2026-15931) and inclusion in Patchstack's vulnerability database suggests active research and potential POC availability. WordPress plugin vulnerabilities of this severity are routinely exploited at scale via automated scanning and exploitation. Without CVSS vector details, we cannot assess privilege requirements or attack complexity, but code injection vulnerabilities in widely-deployed plugins are typically trivial to exploit (low complexity, no privileges required). The fact that affected versions extend from 'n/a' through 8.2.7 suggests a long-standing issue, increasing likelihood of exploitation in the wild.

An attacker discovers a WordPress site running Nelio AB Testing 8.2.7 or earlier via plugin detection methods or HTTP header fingerprinting. The attacker crafts a malicious HTTP request containing injected PHP code targeting an unvalidated parameter in the plugin's A/B testing engine, such as a test configuration endpoint or experiment parameter. The plugin processes this input without proper sanitization and executes the injected code server-side, granting the attacker arbitrary code execution. The attacker can then create a backdoor admin account, exfiltrate sensitive data, inject malware into all site content, or pivot to attack hosting infrastructure—all within minutes of discovering the vulnerable site.